Port 1025

[Bill Bradshaw]

I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?

 

[David W. Hodgins]

I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:
Active Connections
Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Doing a google search on "port 1025 tcp listening microsoft"
shows there are quite a few trojans that can use port 1025.

If this is a w2k system, it also appears mstask.exe can
listen on this port.

Try killing the mstask process, and running the netstat again,
to see if it closes the port.

Regards, Dave Hodgins

 

[StarScripter]

==> *Bill Bradshaw* from: (e-mail address removed)
==> scribbled in: [email protected]

I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?

Hi,
Download and install freeware TCPView from sysinternals and it should show
wich service or program is listening on port 1025.
http://www.sysinternals.com/ntw2k/source/tcpview.shtml
hth

 

[John Coutts]

Generally speaking, ports above 1023 are dynamically assigned. You will find
that some service (NT/2000/XP) is using that port when it is activated. In
order to get rid of that port, you must shut down the service that it is
supporting (removing the modem doesn't do that). With a little work, you can
reduce the open ports to:

Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 192.168.1.6:139 0.0.0.0:0 LISTENING
UDP 192.168.1.6:137 *:*
UDP 192.168.1.6:138 *:*

For further info, see: http://www.yellowhead.com/xpcfg1.htm
****************** REPLY SEPARATER *********************

 

[null]

Generally speaking, ports above 1023 are dynamically assigned. You will find
that some service (NT/2000/XP) is using that port when it is activated. In
order to get rid of that port, you must shut down the service that it is
supporting (removing the modem doesn't do that). With a little work, you can
reduce the open ports to:

Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 192.168.1.6:139 0.0.0.0:0 LISTENING
UDP 192.168.1.6:137 *:*
UDP 192.168.1.6:138 *:*

John, based on his posts in a recent different thread, the OP uses Win
98SE on a stand alone PC. He's already closed port 139 and his netstat
-an result only shows his proxy on 8080 plus the mysterious loopback
(I guess it is) on 1025. The question (I'm pretty sure) is what
service or program might be causing his port 1025 result.

For further info, see: http://www.yellowhead.com/xpcfg1.htm
****************** REPLY SEPARATER *********************

Art
http://www.epix.net/~artnpeg

 

[Bill Bradshaw]

No. Actually I went into task manager and started shutting down programs.
The Symantec common client program ccapp.exe is the culprit. I have not had
time to search the web to try and find an answer as to why this program is
supposedly listening on port 1025. As was pointed out when I first connect
through DUN the only ports that show up in netstat -an are 1025 and 8080
(Webwasher).

 

[null]

No. Actually I went into task manager and started shutting down programs.
The Symantec common client program ccapp.exe is the culprit.

I don't use NAV but I would guess then that it has to do with NAV's
auto-updating functionality. Now that you know what it is, you can
ignore it just as you should ignore your netstat result concerning
your proxy. They are harmless.






Art
http://www.epix.net/~artnpeg

 

[null]

The Symantec common client program ccapp.exe is the culprit. I have not had
time to search the web to try and find an answer as to why this program is
supposedly listening on port 1025.

I cut and pasted this this from a Symantec web site since the url was
too long. Just Google up ccapp.exe to find the page:
******************************************************************************
ccApp is an important part of the protection that Norton AntiVirus
(NAV) or Norton Internet Security (NIS) provides and should not be
disabled at startup.

ccApp.exe is the common hosting application that is used by both NAV
and NIS. It is responsible for calling the different program features
in NAV and NIS. For example, in NAV, if Auto-Protect and Email
Scanning are enabled, then ccApp.exe makes sure that those programs
are running. If ccApp is disabled, then Auto-Protect and Email
Scanning will not run.
***********************************************************************

Art
http://www.epix.net/~artnpeg

 

[Michael Thompson]

I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?
--
<Bill>

Brought to you from beautiful Unalaska/Dutch Harbor, Alaska.
N 53° 51.140' W 166° 30.228' (WGS 84)

You have a AntiVirus program? Most likely it interfacing on the TCP/IP
stack for mail. Nav as I used to use it listend on ports 1025-1027